Fix subresources not going through WebView's interception when a frame is served through AppCache.

Bug: 977873

Change-Id: I953a7bbc3a3dcf4442126136cca36812d8a51f8b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1696218
Commit-Queue: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Nate Fischer <ntfschr@chromium.org>
Auto-Submit: John Abd-El-Malek <jam@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676261}

android_webview/browser/aw_content_browser_client.cc

@@ -1103,6 +1103,24 @@ bool AwContentBrowserClient::WillCreateURLLoaderFactory(
   return true;
 }
 
+void AwContentBrowserClient::WillCreateURLLoaderFactoryForAppCacheSubresource(
+    int render_process_id,
+    network::mojom::URLLoaderFactoryPtrInfo* factory_ptr_info) {
+  DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  auto proxied_ptr_info = std::move(*factory_ptr_info);
+  network::mojom::URLLoaderFactoryRequest factory_request =
+      mojo::MakeRequest(factory_ptr_info);
+
+  base::PostTaskWithTraits(
+      FROM_HERE, {content::BrowserThread::IO},
+      base::BindOnce(&AwProxyingURLLoaderFactory::CreateProxy,
+                     render_process_id, std::move(factory_request),
+                     std::move(proxied_ptr_info),
+                     nullptr /* AwInterceptedRequestHandler */));
+}
+
 uint32_t AwContentBrowserClient::GetWebSocketOptions(
     content::RenderFrameHost* frame) {
   uint32_t options = network::mojom::kWebSocketOptionNone;

android_webview/browser/aw_content_browser_client.h

@@ -241,6 +241,9 @@ class AwContentBrowserClient : public content::ContentBrowserClient {
       network::mojom::URLLoaderFactoryRequest* factory_request,
       network::mojom::TrustedURLLoaderHeaderClientPtrInfo* header_client,
       bool* bypass_redirect_checks) override;
+  void WillCreateURLLoaderFactoryForAppCacheSubresource(
+      int render_process_id,
+      network::mojom::URLLoaderFactoryPtrInfo* factory_ptr_info) override;
   uint32_t GetWebSocketOptions(content::RenderFrameHost* frame) override;
   bool WillCreateRestrictedCookieManager(
       content::BrowserContext* browser_context,

content/browser/frame_host/render_frame_host_impl.cc

@@ -4874,9 +4874,20 @@ void RenderFrameHostImpl::CommitNavigation(
     if (subresource_loader_params &&
         subresource_loader_params->appcache_loader_factory_info.is_valid()) {
       // If the caller has supplied a factory for AppCache, use it.
-      subresource_loader_factories->appcache_factory_info() =
+
+      auto factory_ptr_info =
           std::move(subresource_loader_params->appcache_loader_factory_info);
 
+#if defined(OS_ANDROID)
+      GetContentClient()
+          ->browser()
+          ->WillCreateURLLoaderFactoryForAppCacheSubresource(
+              GetProcess()->GetID(), &factory_ptr_info);
+#endif
+
+      subresource_loader_factories->appcache_factory_info() =
+          std::move(factory_ptr_info);
+
       // Inject test intermediary if needed.
       if (!GetCreateNetworkFactoryCallbackForRenderFrame().is_null()) {
         network::mojom::URLLoaderFactoryPtrInfo original_factory =

content/public/browser/content_browser_client.cc

@@ -750,6 +750,12 @@ bool ContentBrowserClient::WillCreateURLLoaderFactory(
   return false;
 }
 
+#if defined(OS_ANDROID)
+void ContentBrowserClient::WillCreateURLLoaderFactoryForAppCacheSubresource(
+    int render_process_id,
+    network::mojom::URLLoaderFactoryPtrInfo* factory_ptr_info) {}
+#endif
+
 bool ContentBrowserClient::WillInterceptWebSocket(RenderFrameHost*) {
   return false;
 }

content/public/browser/content_browser_client.h

@@ -1247,6 +1247,19 @@ class CONTENT_EXPORT ContentBrowserClient {
       network::mojom::TrustedURLLoaderHeaderClientPtrInfo* header_client,
       bool* bypass_redirect_checks);
 
+#if defined(OS_ANDROID)
+  // Similar to WillCreateURLLoaderFactory but for appcache subresources.
+  // WillCreateURLLoaderFactory couldn't be used because when the appcache
+  // URLLoaderFactory is sent on the UI thread, the URLLoaderFactoryRequest is
+  // already consumed. And on the IO thread when it's created but before it's
+  // consumed, we don't have the process ID.
+  // This is behind an OS_ANDROID ifdef because we don't need this on desktop.
+  // Only WebView should implement this, see https://crbug.com/977873.
+  virtual void WillCreateURLLoaderFactoryForAppCacheSubresource(
+      int render_process_id,
+      network::mojom::URLLoaderFactoryPtrInfo* factory_ptr_info);
+#endif
+
   // Returns true when the embedder wants to intercept a websocket connection.
   virtual bool WillInterceptWebSocket(RenderFrameHost* frame);